nx_capability_route.nx

nx_capability_route.nx -- THE GLOBAL FUNCTIONALITY SPLIT (operator 2026-06-28: "global capabilities like mail or admin live on the .xxx.com [subdomain] ... the site visitors contents live on the forward slash off the root domain"). A PURE host-header classifier (NO syscalls, NO imports -> unit-gateable offline against crafted host strings, exactly like nx_sni_route): given a request Host, decide whether it is a CAPABILITY subdomain (mail.<d> / admin.<d> = the GLOBAL machinery, SAME for every domain) or CONTENT (<d> / www.<d> = the per-domain public site, served by PATH). The TLS-terminating front (the sites daemon) calls cr_capability per request: CR_CONTENT -> serve the per-domain docroot via the content router (nx_host_router hr_serve3), path-routed CR_ADMIN/MAIL -> reverse-proxy to the loopback capability daemon (the SAME pattern by which the sites daemon already reverse-proxies nx_status_daemon) Data-driven prefix table (Cardinal 11: add a capability = add a prefix row, no logic change). The actual reverse-proxy wiring into the sites daemon + running the loopback daemons + the *.<d> cert SANs are the operator-gated DEPLOY step; this is the routing DECISION, sovereign + proven. license_tier: ORIGINAL